0m.ax
42b2ce4d1d
Self-hostable OTA update system for NixOS fleets: a control server, device agent, publisher CLI, and NixOS modules that ship prebuilt system closures from a binary cache to devices that don't have the flake. - crates/common: signed manifest types (ed25519), store-path validator - crates/server: axum + sqlite + HTMX dashboard, channel/device API - crates/agent: poll, verify signature + revision, nix copy, switch, health check, magic-rollback on failure - crates/publisher: keygen + sign + publish CLI for operators/CI - nix/modules: NixOS modules for server and agent - nix/tests/ota.nix: end-to-end VM test exercising publish A -> B -> broken C -> rollback to B (passes) The control server never holds the signing key; manifests are signed offline and verified against a pinned public key on each device.
53 lines
1.7 KiB
Nix
53 lines
1.7 KiB
Nix
self: { config, lib, pkgs, ... }:
|
|
let
|
|
cfg = config.services.nix-ota-server;
|
|
inherit (lib) mkEnableOption mkOption mkIf types;
|
|
in {
|
|
options.services.nix-ota-server = {
|
|
enable = mkEnableOption "nix-ota control server";
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = self.packages.${pkgs.system}.nix-ota-server;
|
|
};
|
|
listen = mkOption { type = types.str; default = "0.0.0.0:8080"; };
|
|
dataDir = mkOption { type = types.path; default = "/var/lib/nix-ota-server"; };
|
|
publishTokenFile = mkOption {
|
|
type = types.nullOr types.path;
|
|
default = null;
|
|
description = "Path to a file containing the bearer token for /publish.";
|
|
};
|
|
openFirewall = mkOption { type = types.bool; default = false; };
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
users.users.nix-ota = {
|
|
isSystemUser = true; group = "nix-ota"; home = cfg.dataDir; createHome = true;
|
|
};
|
|
users.groups.nix-ota = {};
|
|
|
|
systemd.services.nix-ota-server = {
|
|
description = "nix-ota control server";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
serviceConfig = {
|
|
User = "nix-ota";
|
|
Group = "nix-ota";
|
|
WorkingDirectory = cfg.dataDir;
|
|
Restart = "on-failure";
|
|
StateDirectory = "nix-ota-server";
|
|
};
|
|
script = ''
|
|
${lib.optionalString (cfg.publishTokenFile != null) ''
|
|
export NIX_OTA_PUBLISH_TOKEN="$(cat ${cfg.publishTokenFile})"
|
|
''}
|
|
exec ${cfg.package}/bin/nix-ota-server \
|
|
--listen ${cfg.listen} \
|
|
--db ${cfg.dataDir}/nix-ota.db
|
|
'';
|
|
};
|
|
|
|
networking.firewall = mkIf cfg.openFirewall {
|
|
allowedTCPPorts = [ (lib.toInt (lib.last (lib.splitString ":" cfg.listen))) ];
|
|
};
|
|
};
|
|
}
|